CVE-2026-14823 is an authorization bypass vulnerability in the Event Tickets and Registration WordPress plugin prior to version 5.29.0.1. The plugin does not properly verify user authorization on some seating-related actions, allowing users with contributor-level permissions or higher to modify seating layouts, ticket inventories, and attendee seat assignments for events they do not own. This issue is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS v3.1 base score of 2.2, reflecting a low severity with impact limited to integrity. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Users with contributor-level access or higher can alter seating layouts, ticket inventory, and attendee seat assignments for events they do not own, potentially leading to unauthorized modifications of event data. The impact is limited to integrity; confidentiality and availability are not affected. The low CVSS score reflects the limited scope and complexity of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access carefully and monitor for unauthorized changes to event seating and ticket data. Avoid granting contributor or higher privileges to untrusted users.